The sonalsinha21 SKT Skill Bar plugin version 2.5 and earlier contains a DOM-based Cross-site Scripting vulnerability due to improper input neutralization during web page generation. This vulnerability allows an attacker with low privileges and requiring user interaction to inject and execute malicious scripts, potentially affecting the confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring user interaction.

Successful exploitation of this vulnerability could lead to limited disclosure of information, modification of data, and partial disruption of service within the context of the affected web application. The attack requires user interaction and low privileges, which limits the scope but still poses a risk to users and data handled by the SKT Skill Bar plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided, users should monitor for updates from the vendor sonalsinha21. Until a fix is available, consider applying input validation and output encoding controls at the application level to mitigate DOM-based XSS risks.